@netlify/build 36.0.0 → 36.1.0

package/lib/env/changes.d.ts

@@ -1,5 +1,4 @@
 export function getNewEnvChanges(envBefore: any, netlifyConfig: any, netlifyConfigCopy: any): any;
 export function setEnvChanges(envChanges: any, currentEnv?: NodeJS.ProcessEnv): {
     [key: string]: string | undefined;
-    TZ?: string;
 };

package/lib/log/logger.js

@@ -33,7 +33,7 @@ export const getBufferLogs = (config) => {
 export const log = function (logs, string, config = {}) {
     const { indent = false, color } = config;
     const stringA = indent ? indentString(string, INDENT_SIZE) : string;
-    const stringB = String(stringA).replace(EMPTY_LINES_REGEXP, EMPTY_LINE);
+    const stringB = stringA.replace(EMPTY_LINES_REGEXP, EMPTY_LINE);
     const stringC = color === undefined ? stringB : color(stringB);
     if (logs && logs.outputFlusher) {
         logs.outputFlusher.flush();

package/lib/log/messages/core_steps.d.ts

@@ -34,9 +34,8 @@ export function logDbMigrations({ logs, migrations, srcDir }: {
 }): void;
 export function logSecretsScanSkipMessage(logs: any, msg: any): void;
 export function logSecretsScanSuccessMessage(logs: any, msg: any): void;
-export function logSecretsScanFailBuildMessage({ logs, scanResults, groupedResults, enhancedScanShouldRunInActiveMode, }: {
+export function logSecretsScanFailBuildMessage({ logs, scanResults, groupedResults }: {
     logs: any;
     scanResults: any;
     groupedResults: any;
-    enhancedScanShouldRunInActiveMode: any;
 }): void;

package/lib/log/messages/core_steps.js

@@ -1,6 +1,5 @@
 import path from 'path';
 import { RUNTIME } from '@netlify/zip-it-and-ship-it';
-import { trace } from '@opentelemetry/api';
 import { log, logArray, logError, logErrorSubHeader, logWarningSubHeader } from '../logger.js';
 import { THEME } from '../theme.js';
 const logBundleResultFunctions = ({ functions, headerMessage, logs, error }) => {
@@ -68,6 +67,8 @@ export const trackBundleResults = ({ results = [], systemLog }) => {
         name: result.name,
         runtime: result.runtime,
         bundler: result.runtime === RUNTIME.JAVASCRIPT ? result.bundler : null,
+        bundlerReason: result.runtime === RUNTIME.JAVASCRIPT ? (result.bundlerReason ?? null) : null,
+        sizeBytes: result.size ?? null,
         hadFallback: (result.bundlerErrors?.length ?? 0) > 0,
         hadWarnings: (result.bundlerWarnings?.length ?? 0) > 0,
     }));
@@ -79,23 +80,13 @@ export const trackBundleResults = ({ results = [], systemLog }) => {
     const fallbackCount = perFunction.filter((p) => p.hadFallback).length;
     const warningsCount = perFunction.filter((p) => p.hadWarnings).length;
     systemLog({
-        msg: 'Functions bundling completed',
+        msg: 'Functions bundling completed successfully',
         bundlers,
         bundlerCounts,
         fallbackCount,
         warningsCount,
         functions: perFunction,
     });
-    const span = trace.getActiveSpan();
-    if (span) {
-        span.setAttribute('build.execution.step.bundler', bundlers);
-        span.setAttribute('build.execution.step.functions_count', perFunction.length);
-        span.setAttribute('build.execution.step.bundler.fallback_count', fallbackCount);
-        span.setAttribute('build.execution.step.bundler.warnings_count', warningsCount);
-        for (const [bundler, count] of Object.entries(bundlerCounts)) {
-            span.setAttribute(`build.execution.step.bundler.${bundler}.count`, count);
-        }
-    }
     return { bundlers, fallbackCount, warningsCount };
 };
 export const logFunctionsNonExistingDir = function (logs, relativeFunctionsSrc) {
@@ -180,11 +171,11 @@ export const logSecretsScanSkipMessage = function (logs, msg) {
 export const logSecretsScanSuccessMessage = function (logs, msg) {
     log(logs, msg, { color: THEME.highlightWords });
 };
-export const logSecretsScanFailBuildMessage = function ({ logs, scanResults, groupedResults, enhancedScanShouldRunInActiveMode, }) {
+export const logSecretsScanFailBuildMessage = function ({ logs, scanResults, groupedResults }) {
     const { secretMatches, enhancedSecretMatches } = groupedResults;
     const secretMatchesKeys = Object.keys(secretMatches);
     const enhancedSecretMatchesKeys = Object.keys(enhancedSecretMatches);
-    logErrorSubHeader(logs, `Scanning complete. ${scanResults.scannedFilesCount} file(s) scanned. Secrets scanning found ${secretMatchesKeys.length} instance(s) of secrets${enhancedSecretMatchesKeys.length > 0 && enhancedScanShouldRunInActiveMode ? ` and ${enhancedSecretMatchesKeys.length} instance(s) of likely secrets` : ''} in build output or repo code.\n`);
+    logErrorSubHeader(logs, `Scanning complete. ${scanResults.scannedFilesCount} file(s) scanned. Secrets scanning found ${secretMatchesKeys.length} instance(s) of secrets${enhancedSecretMatchesKeys.length > 0 ? ` and ${enhancedSecretMatchesKeys.length} instance(s) of likely secrets` : ''} in build output or repo code.\n`);
     // Explicit secret matches
     secretMatchesKeys.forEach((key) => {
         logError(logs, `Secret env var "${key}"'s value detected:`);
@@ -200,22 +191,20 @@ export const logSecretsScanFailBuildMessage = function ({ logs, scanResults, gro
         logError(logs, `\nTo prevent exposing secrets, the build will fail until these secret values are not found in build output or repo files.`);
         logError(logs, `\nIf these are expected, use SECRETS_SCAN_OMIT_PATHS, SECRETS_SCAN_OMIT_KEYS, or SECRETS_SCAN_ENABLED to prevent detecting.`);
     }
-    if (enhancedScanShouldRunInActiveMode) {
-        // Likely secret matches from enhanced scan
-        enhancedSecretMatchesKeys.forEach((key, index) => {
-            logError(logs, `${index === 0 && secretMatchesKeys.length ? '\n' : ''}"${key}***" detected as a likely secret:`);
-            enhancedSecretMatches[key]
-                .sort((a, b) => {
-                return a.file > b.file ? 0 : 1;
-            })
-                .forEach(({ lineNumber, file }) => {
-                logError(logs, `found value at line ${lineNumber} in ${file}`, { indent: true });
-            });
+    // Likely secret matches from enhanced scan
+    enhancedSecretMatchesKeys.forEach((key, index) => {
+        logError(logs, `${index === 0 && secretMatchesKeys.length ? '\n' : ''}"${key}***" detected as a likely secret:`);
+        enhancedSecretMatches[key]
+            .sort((a, b) => {
+            return a.file > b.file ? 0 : 1;
+        })
+            .forEach(({ lineNumber, file }) => {
+            logError(logs, `found value at line ${lineNumber} in ${file}`, { indent: true });
         });
-        if (enhancedSecretMatchesKeys.length) {
-            logError(logs, `\nTo prevent exposing secrets, the build will fail until these likely secret values are not found in build output or repo files.`);
-            logError(logs, `\nIf these are expected, use SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES, or SECRETS_SCAN_SMART_DETECTION_ENABLED to prevent detecting.`);
-        }
+    });
+    if (enhancedSecretMatchesKeys.length) {
+        logError(logs, `\nTo prevent exposing secrets, the build will fail until these likely secret values are not found in build output or repo files.`);
+        logError(logs, `\nIf these are expected, use SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES, or SECRETS_SCAN_SMART_DETECTION_ENABLED to prevent detecting.`);
     }
     logError(logs, `\nFor more information on secrets scanning, see the Netlify Docs: https://ntl.fyi/configure-secrets-scanning`);
 };

package/lib/plugins_core/blobs_upload/index.js

@@ -40,6 +40,8 @@ const coreStep = async function ({ logs, deployId, buildDir, packagePath, consta
     try {
         await pMap(blobsToUpload, async ({ key, contentPath, metadataPath }) => {
             const { data, metadata } = await getFileWithMetadata(key, contentPath, metadataPath);
+            // `data` is a `Buffer`, typed by @types/node as `Buffer<ArrayBufferLike>`, which TS
+            // rejects as a `BlobPart`; the runtime value is a valid blob part.
             await blobStore.set(key, new Blob([data]), { metadata });
         }, { concurrency: 10 });
     }

package/lib/plugins_core/db_setup/index.js

@@ -30,13 +30,9 @@ const coreStep = async ({ api, branch, buildDir, constants, context, logs }) =>
     if (migrationNames.length > 0 && migrationsSrc) {
         logDbMigrations({ logs, migrations: migrationNames, srcDir: migrationsSrc });
     }
-    // @ts-expect-error This is an internal method for now so it isn't typed yet.
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
     const database = (await api.createSiteDatabase({ site_id: siteId }));
     let connectionString = database.connection_string;
     if (context !== 'production') {
-        // @ts-expect-error This is an internal method for now so it isn't typed yet.
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-call
         const databaseBranch = (await api.createSiteDatabaseBranch({
             site_id: siteId,
             body: { branch_id: branch },

package/lib/plugins_core/dev_blobs_upload/index.js

@@ -47,6 +47,8 @@ const coreStep = async function ({ debug, logs, deployId, buildDir, quiet, packa
                 log(logs, `- Uploading blob ${key}`, { indent: true });
             }
             const { data, metadata } = await getFileWithMetadata(key, contentPath, metadataPath);
+            // `data` is a `Buffer`, typed by @types/node as `Buffer<ArrayBufferLike>`, which TS
+            // rejects as a `BlobPart`; the runtime value is a valid blob part.
             await blobStore.set(key, new Blob([data]), { metadata });
         }, { concurrency: 10 });
     }

package/lib/plugins_core/secrets_scanning/index.js

@@ -5,13 +5,10 @@ import { logSecretsScanFailBuildMessage, logSecretsScanSkipMessage, logSecretsSc
 import { reportValidations } from '../../status/validations.js';
 import { getFilePathsToScan, getOmitValuesFromEnhancedScanForEnhancedScanFromEnv, getSecretKeysToScanFor, groupScanResultsByKeyAndScanType, isEnhancedSecretsScanningEnabled, isSecretsScanningEnabled, scanFilesForKeyValues, } from './utils.js';
 const tracer = trace.getTracer('secrets-scanning');
-const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecretKeys, enhancedSecretScan, featureFlags, systemLog, deployId, api, }) {
+const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecretKeys, enhancedSecretScan, systemLog, deployId, api, }) {
     const stepResults = {};
     const passedSecretKeys = (explicitSecretKeys || '').split(',');
     const envVars = netlifyConfig.build.environment;
-    // When the flag is disabled, we may still run the scan if a secrets scan would otherwise take place anyway
-    // In this case, we hide any output to the user and simply gather the information in our logs
-    const enhancedScanShouldRunInActiveMode = featureFlags?.enhanced_secret_scan_impacts_builds ?? false;
     systemLog?.({ passedSecretKeys, buildDir });
     if (!isSecretsScanningEnabled(envVars)) {
         logSecretsScanSkipMessage(logs, 'Secrets scanning disabled via SECRETS_SCAN_ENABLED flag set to false.');
@@ -26,20 +23,14 @@ const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecret
     }
     const enhancedScanningEnabledInEnv = isEnhancedSecretsScanningEnabled(envVars);
     const enhancedScanConfigured = enhancedSecretScan && enhancedScanningEnabledInEnv;
-    if (enhancedSecretScan && enhancedScanShouldRunInActiveMode && !enhancedScanningEnabledInEnv) {
+    if (enhancedSecretScan && !enhancedScanningEnabledInEnv) {
         logSecretsScanSkipMessage(logs, 'Enhanced secrets detection disabled via SECRETS_SCAN_SMART_DETECTION_ENABLED flag set to false.');
     }
-    if (enhancedScanShouldRunInActiveMode &&
-        enhancedScanConfigured &&
-        envVars['SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES'] !== undefined) {
+    if (enhancedScanConfigured && envVars['SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES'] !== undefined) {
         log(logs, `SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES override option set to: ${envVars['SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES']}\n`);
     }
     const keysToSearchFor = getSecretKeysToScanFor(envVars, passedSecretKeys);
-    // In passive mode, only run the enhanced scan if we have explicit secret keys
-    const enhancedScanShouldRun = enhancedScanShouldRunInActiveMode
-        ? enhancedScanConfigured
-        : enhancedScanConfigured && keysToSearchFor.length > 0;
-    if (keysToSearchFor.length === 0 && !enhancedScanShouldRun) {
+    if (keysToSearchFor.length === 0 && !enhancedScanConfigured) {
         logSecretsScanSkipMessage(logs, 'Secrets scanning skipped because no env vars marked as secret are set to non-empty/non-trivial values or they are all omitted with SECRETS_SCAN_OMIT_KEYS env var setting.');
         return stepResults;
     }
@@ -60,7 +51,7 @@ const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecret
             keys: keysToSearchFor,
             base: buildDir,
             filePaths,
-            enhancedScanning: enhancedScanShouldRun,
+            enhancedScanning: enhancedScanConfigured,
             omitValuesFromEnhancedScan: getOmitValuesFromEnhancedScanForEnhancedScanFromEnv(envVars),
         });
         secretMatches = scanResults.matches.filter((match) => !match.enhancedMatch);
@@ -73,8 +64,7 @@ const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecret
             secretsFilesCount: scanResults.scannedFilesCount,
             keysToSearchFor,
             enhancedPrefixMatches: enhancedSecretMatches.length ? enhancedSecretMatches.map((match) => match.key) : [],
-            enhancedScanning: enhancedScanShouldRun,
-            enhancedScanActiveMode: enhancedScanShouldRunInActiveMode,
+            enhancedScanning: enhancedScanConfigured,
         };
         systemLog?.(attributesForLogsAndSpan);
         span.setAttributes(attributesForLogsAndSpan);
@@ -84,13 +74,11 @@ const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecret
         const secretScanResult = {
             scannedFilesCount: scanResults?.scannedFilesCount ?? 0,
             secretsScanMatches: secretMatches ?? [],
-            enhancedSecretsScanMatches: enhancedScanShouldRunInActiveMode && enhancedSecretMatches ? enhancedSecretMatches : [],
+            enhancedSecretsScanMatches: enhancedSecretMatches ? enhancedSecretMatches : [],
         };
         reportValidations({ api, secretScanResult, deployId, systemLog });
     }
-    if (!scanResults ||
-        scanResults.matches.length === 0 ||
-        (!enhancedScanShouldRunInActiveMode && !secretMatches?.length)) {
+    if (!scanResults || scanResults.matches.length === 0) {
         logSecretsScanSuccessMessage(logs, `Secrets scanning complete. ${scanResults?.scannedFilesCount} file(s) scanned. No secrets detected in build output or repo code!`);
         return stepResults;
     }
@@ -100,7 +88,6 @@ const coreStep = async function ({ buildDir, logs, netlifyConfig, explicitSecret
         logs,
         scanResults,
         groupedResults: groupScanResultsByKeyAndScanType(scanResults),
-        enhancedScanShouldRunInActiveMode,
     });
     const error = new Error(`Secrets scanning found secrets in build.`);
     addErrorInfo(error, { type: 'secretScanningFoundSecrets' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netlify/build",
-  "version": "36.0.0",
+  "version": "36.1.0",
   "description": "Netlify build module",
   "type": "module",
   "exports": "./lib/index.js",
@@ -70,13 +70,13 @@
     "@netlify/blobs": "^10.4.4",
     "@netlify/cache-utils": "^7.0.0",
     "@netlify/config": "^25.0.0",
-    "@netlify/edge-bundler": "15.0.0",
-    "@netlify/functions-utils": "^7.0.0",
+    "@netlify/edge-bundler": "15.0.1",
+    "@netlify/functions-utils": "^7.0.2",
     "@netlify/git-utils": "^7.0.0",
     "@netlify/opentelemetry-utils": "^3.0.0",
     "@netlify/plugins-list": "^6.81.6",
     "@netlify/run-utils": "^7.0.0",
-    "@netlify/zip-it-and-ship-it": "15.0.0",
+    "@netlify/zip-it-and-ship-it": "15.1.0",
     "@sindresorhus/slugify": "^2.0.0",
     "ansi-escapes": "^7.0.0",
     "ansis": "^4.1.0",
@@ -122,7 +122,7 @@
     "@netlify/nock-udp": "^6.0.0",
     "@opentelemetry/api": "~1.8.0",
     "@opentelemetry/sdk-trace-base": "~1.24.0",
-    "@types/node": "^18.19.111",
+    "@types/node": "^22.12.0",
     "atob": "^2.1.2",
     "ava": "^5.0.0",
     "c8": "^10.0.0",
@@ -152,5 +152,5 @@
   "engines": {
     "node": ">=22.12.0"
   },
-  "gitHead": "bdaf7cd5e14049c31a236c9432f192f78c6c31c8"
+  "gitHead": "677f1bd6db4429d70ce3d207f00c7d603ae2d1bf"
 }